The 1180px Shortcodes plugin for WordPress is vulnerable because the value supplied to the ‘class’ attribute of its shortcodes is not properly sanitized or escaped. Authenticated users with Contributor or higher privileges can store malicious scripts that will execute for every visitor who accesses a page containing the affected shortcode. This stored cross‑site scripting can lead to credential theft, session hijacking, defacement, or delivery of additional malware, compromising the confidentiality, integrity, and availability of site visitors.

WordPress installations that have the 1180px Shortcodes plugin from chrisblackwell, with version 1.1.1 or any earlier release, are affected. All releases up to and including 1.1.1 contain the vulnerable code path.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with Contributor or higher privileges, making the attack vector internal. Once an attacker stores a payload, it persists and is delivered to every site visitor until the vulnerability is remediated.